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The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). '* 

Status \ 

1)^ Responsive to communication(s) filed on 20 October 2006 . 
2a)C] This action is FINAL. 2b)S This action is non-final. 

3) 0 Since this application is in condition for allowance except for fornnal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-27 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) 0 Claim(s) is/are allowed. 

6) IEI Claim(s) 1-27 is/are rejected. 
?)□ Claim(s) is/are objected to. 

8) \Z\ Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) 0 The specification is objected to by the Examiner. 

10) n The drawing(s) filed on is/are: a)n accepted or b)n objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction Is required If the drawing(s) is objected to. See 37 CFR 1.121(d). 

11) 0 The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-1 52. 

Priority under 35 U.S.C. § 119 

12) 0 Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)n All * b)n Some * c)^ None of: 

!□ Certified copies of the priority documents have been received. 
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3. n Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (POT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

1 . This Office action is responsive to the Appeal Brief filed 1 0/20/2006. 
Claims 1-27 remain for examination. 

Response to Arguments 

2. An appeal conference has met and fully considered applicants' remarks in the 
Appeal Brief. The Conferees agreed with the applicants on the argument on the page 
10-19. However, a newly found prior art has brought the pending claims 1-27 to the 
rejection below. Examiner provides a new ground of rejection below for claims 1-27. 

Reopening of Prosecution - New Ground of Rejection After Appeal or Examiner's 
Rebuttal of Reply Brief In view of the Appeal Brief filed on 10/20/06, PROSECUTION IS 
HEREBY REOPENED. A new ground of rejection is set forth below. To avoid 
abandonment of the application, appellant must exercise one of the following two 
options: (1) file a reply under 37 CFR 1.111 (if this Office action is non-final) or a reply 
under 37 CFR 1.113 (if this Office action is final); or, (2) request reinstatement of the 
appeal. If reinstatement of the appeal is requested, such request must be accompanied 
by a supplemental appeal brief, but no new amendments, affidavits (37 CFR 1.130, 
1.131 or 1.132) or other evidence are permitted. See 37 CFR 1.193(b)(2). 
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Claim Objections 

3. Claims 1 , 9 and 17 are objected to because of tlie following infonnalities: the 
limitation "scanning code operable as a low priority task within a multitasking 
environment" in lines 6-7 of Claims 1 , 9 and 17. This is insufficient for this limitation in 
claim. It is unclear what Applicant's intended metes and bounds of the claim. Applicant 
is needed to clarify this limitation to distinguish from the prior arts. Appropriate 
correction is required. 

Claim Rejections - 35 USC § 101 

35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or 
composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, 
subject to the conditions and requirements of this title. 

4. Claims 1-8 and 25-27 are rejected under 35 U.S.C. 101 because the claimed 
invention is directed to non-statutory subject matter. 

Claim 1 is directed to "A computer program product for controlling operation...." 
Applicant intends to cover signals or waves (note Specification, page 8, lines 30-32). A 
claimed signal has no physical structure, does not itself perform any useful, concrete 
and tangible result. Therefore, A computer program product of Claim 1 is directed to 
non-statutory subject matter. 

Claims 2-8 and 25-27 are also rejected because of dependency. 
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Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C; 102 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351 (a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

5. Claims 1-27 are rejected under 35 U.S.C. 102(e) as being anticipated by Caronni 
et al. (U.S. Patent Application Publication 2002/0143850 A1) hereinafter Caronni. 

Referring to Claims 1 , 9 and 17, Caronni discloses a computer program product 
for controlling operation of a computer to detect malware, said computer program 
product comprising: 

pending scan database code operable to maintain a pending scan database (the 
progress indicator is linlced to a data resource 240. Example of data resources 
comprise databases (e.g. relational database), flat files, a hash table and any data 
storage media) (Figure 2, element 240 and paragraph 0029) storing data Identifying 
computer files that have been written to a data storage device (Figure 4, element 412) 
and for which a scan for malware has yet to be performed (Processor 413 may 
execute the received code as it is received and/stored in mass storage 412) 
(paragraph 0057) (a system for scanning incoming data for viruses. The system 
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comprises one or more processing nodes that have access to a library of virus 
signature (data source) (Figures 2-4, and paragraph 0029); and 

scanning code operable as a low priority task within a multitasking environment 
(a data processing node may run low on memory due to high volume of incoming 
data. In this example, the processing node may be configured to suspend virus 
scanning and reroute the processing to a different processing node with available 
resource) (paragraphs 0030), (Once the processing is complete, the device is 
tasked with other higher priority jobs, or the device elects to stop processing 
prior to completely processing the packet data) (paragraph 0035) to conduct 
malware scanning upon computer files identified within said pending scan database 
storing data identifying computer files (files) that haven been written to said data storage 
device and for which the scan for malware has yet to be performed (a system for 
scanning incoming data for viruses. The system comprises one or more 
processing nodes that have access to a library of virus signature (data source). 
Such a library may be stored in the relational database, flat file, hash table or 
obtained from a server. Each node is enabled to access the virus signature 
library and scan the data the presence of any of the virus signatures. In this 
example, the progress indicator contains a reference or a pointer to the virus 
signature being scanned) (Figures 2-4, paragraph 0029-0030 and 0035). 

Referring to Claims 2, 10 and 18, Caronni discloses the limitations as discussed 
in Claims 1, 9 and 17 above. Caronni further discloses file write code operable as a 
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computer file is written to a storage device to add data identifying said computer file to 
said pending scan database (paragraph 0030). 

Referring to Claims 3, 1 1 and 19, Caronni discloses the limitations as discussed 
in Claims 1, 9 and 17 above. Caronni further discloses file read code operable in 
response to a read request for a computer file included within said pending scan 
database to trigger said scanning code to scan said computer file as a high priority task 
before permitting read access to said computer file (paragraph 0035). 

Referring to Claims 4, 12 and 20, Caronni discloses the limitations as discussed 
in Claims 1, 9 and 17 above. Caronni further discloses scanned file database code 
operable to maintain a scanned file database storing data identifying computer files that 
have been scanned for malware (paragraph 0029). 

Referring to Claims 5, 13 and 21, Caronni discloses the limitations as discussed 
in Claim 4 above. Caronni further discloses wherein said data identifying computer files 
that have been scanned for malware includes checksum data derived from said 
computer files that were scanned (paragraph 0049). 

Referring to Claims 6, 14 and 22, Caronni discloses the limitations as discussed 
in Claim 5 above, Caronni further discloses file read code operable in response to a 
read request for a computer file to detected if said computer file is within said scanned 
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file database and a checksum value recalculated for said computer file matches that 
stored within said scanned file database before permitting said read request (paragraph 
0045 and 0049). 

Referring to Claims 7, 15 and 23,.Caronni discloses the limitations as discussed 
in Claim 4 above, Caronni further discloses initiation code operable upon startup to 
detect any computer files stored on a storage device not included within either said 
pending scan database or said scanned file database and to add such computer files to 
said pending scan database (paragraph 0029-0030). 

Referring to Claims 8, 16 and 24, Caronni discloses the limitations as discussed 
in Claim 1 above, Caronni further discloses wherein said malware comprises one or 
more of: (i) a computer file infected with a computer virus; (ii) a Trojan; (iii) a banned 
computer file; and (iv) a computer file containing banned content (paragraph 0029). 

Referring to Claim 25, Caronni discloses the limitations as discussed in Claim 1 
above, Caronni further discloses wherein an order of said computer files identified within 
said pending scan database being scanned is based on an algorithm that estimates the 
likelihood of a read request being performed on each computer file (paragraph 0044- 
0045). 



Application/Control Number: 09/975,991 Page 8 

Art Unit: 2135 

Referring to Claim 26, Caronni discloses the limitations as discussed in Claim 4 
above, Caronni further discloses wherein only computer files determined to be clean 
from malware scanning are stored in the scanned file database (paragraph 0009 and 
0030). 

Referring to Claim 27, Caronni discloses the limitations as discussed in Claim 1 
above, Caronni further discloses wherein an order of said computer files identified within 
said pending database being scanned is based on the order in which said computer 
files were placed in said pending scan database (paragraph 0029, 0030 and 0035). 

Contact Information 

6. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Baotran N. To whose telephone number is 571-272- 
8156. The examiner can normally be reached on Monday-Friday from 8:00 to 4:30. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Y. Vu can be reached on 571-272-3859. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



BT 

01/16/2007 




]M VU 

SUrZ ■"'"-'^V PATENT EXAMINER 
TECHr^ULUGY CENTER 2100 




